I thought I would share these wishes with all forum members (they were originally posted in the usability forum, which is accessible only to users with special privileges).
Auto suspend
How about an option for Killswitch to automatically suspend any newly launched process that is unknown, suspicious, or malicious?. If you have this option, it may be helpful in two scenarios:
1) Have a small installer that can install a special "lock-up rescue" version of killswitch. This installer would early-load killswitch on start-up (using a random filename), but this version of killswitch will automatically "suspend all unsafe objects" when it starts. When an infected system is too bogged down by malware, trying to run killswitch in its current configuration is often impossible.
2) Running Killswitch in background. If you have malware that keeps re-launching new processes, Killswitch will automatically suspend the processes and not let them lock up the machine. This would be most useful for zero-day malware for which there is no signature (so verdict from comodo, other AV vendors, and CAMAS may be unknown).
When the Internet Connection is disabled
Provide a method to download the latest AV database and white list for CCE. If malware disables the internet connection, then CCE and killswitch cannot access DACS, CAMAS, the cloud, and updates. In this case, you need to download the most up-to-date information from another computer, and transfer the files to the infected computer.
Eliminate traces
Also, it would be nice if CCE eliminated malware "traces". I know the most important issue is getting rid of active or potentially active malware ("acid" cleaning), but getting rid of traces is a nice way to add a "polished shine" on what you've just cleaned.
Tools That Fix system settings
Add tools to scan for and correct system changes made by malware (e.g. deactivation of task manager, home page hijack, disable control panel, etc.). Maybe you can build these into the standard scan.
